Search code examples
nuget

NuGet and sigstore

I stumbled across the sigstore project and mostly found information on how it helps avoid tampered npm packages.

Is this also relevant for NuGet packages? Or is the attack vector sigstore addresses with npm not relevant for NuGet?

Solution

  • It is relevant to NuGet packages, since they can be signed. Unfortunately for Nuget.org use case, Microsoft requires signing with public certificate authority that is on their approved list. And Sigstore isn't on that list.

    So Nuget.org would require some changes to support Sigstore if Sigstore isn't added to the list. And I haven't seen any issue opened for this on Nuget's issues page.

    You can naturally do verifications by yourself if you have your own NuGet repository.